What is vishing? Definition, example calls and warning signs

Vishing (from “voice phishing”) is a scam carried out by telephone. The caller poses as someone trustworthy in order to obtain information, a code or a payment. The difference from phishing is the channel. Here the attacker speaks, and can react in real time to every hesitation.

This article gives a definition of vishing, examples of typical calls and the warning signs you can pick up by ear. It also explains how to prepare a team.

What does vishing mean?

The word combines “voice” and “phishing”. Vishing is therefore a form of phishing where the lure is a spoken conversation. Cybermalveillance.gouv.fr, the French national cyber-victim assistance service, describes phishing as a fraudulent technique designed to deceive the victim, in particular through a “fake message, text message or phone call from a bank”.

The caller does not need to hack a system. They get the victim to hand over what a technical tool would refuse them. For example a code received by text message, a password or an approval in an app. This is known as social engineering, because the target of the attack is the relationship of trust, not the machine.

Vishing, phishing, smishing: what are the differences?

The three terms describe the same principle (deceiving someone to get something) through different channels.

• Phishing: the lure arrives by email, with a booby-trapped link or attachment.
• Smishing: the lure arrives by text or messaging app, often with a link to a fake website.
• Vishing: the lure arrives by phone call or voice message.

Vishing stands out for its pressure. An email can be reread, forwarded, reported. A call demands an immediate answer, leaves no written trace and gives no time to think it over.

The channels are also often combined. A fake text pushes the victim to call back a number, or a call announces that a code is about to arrive by text. Current campaigns mix all three. The Cybermalveillance.gouv.fr press release of March 26, 2026 refers to waves of phishing “by text message, email or even audio calls”.

Examples of vishing calls

Here are three typical scenarios, built to illustrate the mechanism. They do not describe any real case.

The fake bank advisor

Imagine a call displayed under the bank's name. The calm, professional voice announces suspicious transactions on the account. It asks you to “secure” the account by approving a notification in the banking app. In reality, the approval authorizes a wire transfer to the fraudster. The full method is described in our article on the fake bank advisor scam.

The fake supplier or fake executive

Imagine an accountant receives a call from a supposed supplier: “We have changed banks, the next payment needs to go to this new account.” Or a voice introduces itself as senior management and demands an urgent, confidential wire transfer. This scenario is analysed in CEO fraud by phone.

The fake IT support caller

Imagine a call to the help desk: “I'm traveling, I've lost my phone, can you reset my access?” The caller knows the name of the manager and the department, details found online. Without a verification procedure, the agent helps out. The attacker then gains access to the information system.

Warning signs you can hear

No single sign is enough on its own. It is the combination that should make you hesitate. A vishing call often shows several of these traits.

• Urgency: “You need to act within ten minutes.”
• Authority: the bank, senior management, the police, a security team.
• An unusual request: a code, a change of banking details, an approval.
• Isolation: “Don't tell your colleagues, this is confidential.”
• A refusal of callbacks: the caller avoids being contacted through another channel.
• A trustworthy-looking number: the display proves nothing, because a number can be spoofed.

Cybermalveillance.gouv.fr reports that phone number spoofing rose by 517% in 2025, despite regulatory measures such as the French “Naegelen” law. A familiar number on the screen is therefore no proof of identity.

To go further on these mechanisms, see the psychological levers of social engineering.

Why vishing works, even on well-informed people

Knowing that a scam exists is not enough to recognize it live. During the call, the person has to listen, respond, manage emotion and remember a rule, all within a few seconds. The rule learned in an online module often gives way to social pressure.

Attackers know this. The Cybermalveillance.gouv.fr press release mentions call centers of fake advisors specialized in manipulation, fed with stolen data. These callers repeat their pitch hundreds of times. The employee lives through this situation once.

This imbalance is corrected through practice. A reflex is built by repeating the right answer out loud, facing someone who keeps pushing. That is the logic of role play, developed in our analysis of the limits of cybersecurity e-learning.

How to prepare a team for vishing

Preparation rests on three simple elements.

1. One rule that everyone knows: for any sensitive request received by phone, hang up and call back through an independent channel. See the callback procedure.
2. Clear permission to refuse, even when the caller claims to be a senior executive.
3. A simple reporting channel, used without fear of blame, including when the person gave in.

The remaining step is to make these actions automatic. Trainers can do this with a spoken practice scenario. The learner receives a call from a persona played by an AI, and has to verify and refuse. They then receive a debrief with quotes of what they said. Face Up lets trainers write these scenarios from their own real cases. The whole subject is covered in our guide to cybersecurity awareness training on vishing.

What should you say during the call?

When in doubt, the best answer is short, polite and unjustified. Here are phrases to keep at hand.

• “I'll call you back on your department's official number.”
• “I don't give out codes over the phone, whatever the reason.”
• “For a request like this, the procedure requires written approval.”
• “If it's urgent, you'll understand that I check first.”

These phrases have one thing in common: they do not question the caller's sincerity. They apply a rule. The employee accuses no one and does not have to prove that the call is fraudulent.

A genuine contact accepts this check. An attacker insists, gets annoyed or hangs up. That reaction is already useful information, to be noted in the report.

Who is targeted by vishing in a company?

Every role that holds decision-making power, access or information is a target. Cybermalveillance.gouv.fr points out that fake wire transfer order fraud affects every type of organization. They are generally carried out by phone, by electronic message, or both.

• Accounting and treasury teams, who execute payments.
• Executive assistants, who know calendars and approval chains.
• The help desk, which can reset access.
• Customer advisors, who hold information about clients.
• Reception and switchboards, the first contact for an unknown caller.

Each job therefore calls for its own practice scenario. An accountant does not face the same calls as a support agent.

Frequently asked questions

Is vishing the same thing as the fake bank advisor scam?

The fake bank advisor is one form of vishing among others. Vishing covers all fraudulent calls, whether they imitate a bank, a supplier, an executive or IT support.

What should I do if I gave a code during the call?

Immediately warn your bank or your security team through an official channel, and ask for the transactions to be blocked. Then write down how the call went for the report. Our article on reporting a security incident offers a checklist.

Can I trust a number displayed under my bank's name?

No. The displayed number can be spoofed, as the 517% rise in cases observed in 2025 by Cybermalveillance.gouv.fr confirms. Hang up and call the bank's official number.

Is vishing punishable by law?

Yes. According to the Cybermalveillance.gouv.fr fact sheet on fake wire transfer orders, fraud (article 313-1 of the French Criminal Code) carries up to five years in prison. The fine can reach 375,000 euros. Attempted fraud carries the same penalties. Identity theft is also a separate offense.

Are employees responsible if they are tricked?

The most useful approach is to avoid a culture of blame. A person who fears sanction reports late, or not at all. Organizations that encourage fast reporting limit the damage, because every minute counts when it comes to blocking a wire transfer.

To train your teams to spot and refuse a vishing call, book a Face Up demo.